Merge ~adam-collard/maas:websocket-user-change-password into maas:master

[Adam Collard]

LP 1894727: Add websocket endpoint for superusers to change password

[Adam Collard (adam-collard)]

Open question as to whether this is suitable for use by UI.

The UX right now seems to have one form for user details and passwords. This requires logic in the JS app to direct user details to one endpoint and password changes to another, multiplexing the responses and error messages (which I appreciate is non-trivial).

[MAAS Lander (maas-lander)]

UNIT TESTS
-b websocket-user-change-password lp:~adam-collard/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: f76a8607261f8c1a7e004c92e15aad6d259fbe73

review: Approve

[Alberto Donato (ack)]

+1 with a comment inline

[Alberto Donato (ack)]

review: Approve

[MAAS Lander (maas-lander)]

UNIT TESTS
-b websocket-user-change-password lp:~adam-collard/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 9c40e496b7f1aef1036b870c950010af6349f4ab

review: Approve

[MAAS Lander (maas-lander)]

LANDING
-b websocket-user-change-password lp:~adam-collard/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas/job/branch-tester/8553/consoleText

diff --git a/src/maasserver/websockets/handlers/tests/test_user.py b/src/maasserver/websockets/handlers/tests/test_user.py
index 67bcd6e..d221fa2 100644
--- a/src/maasserver/websockets/handlers/tests/test_user.py
+++ b/src/maasserver/websockets/handlers/tests/test_user.py
@@ -394,3 +394,67 @@ class TestUserHandler(MAASServerTestCase):
         )
         self.assertEqual(self.dehydrate_user(user, for_self=True), observed)
         self.assertTrue(user.check_password("newpassword"))
+
+    def test_change_other_users_password_as_admin(self):
+        admin_user = factory.make_admin()
+        handler = UserHandler(admin_user, {}, None)
+        user = factory.make_User()
+
+        response = handler.admin_change_password(
+            {
+                "id": user.id,
+                "password1": "newpassword",
+                "password2": "newpassword",
+            }
+        )
+        user = reload_object(user)
+
+        self.assertIsNone(response)
+        self.assertTrue(
+            user.check_password("newpassword"),
+            "Password not correctly changed",
+        )
+
+    def test_cannot_change_other_users_password_as_unprivileged(self):
+        unprivileged_user = factory.make_User()
+        handler = UserHandler(unprivileged_user, {}, None)
+        user = factory.make_User()
+
+        self.assertRaises(
+            HandlerPermissionError,
+            handler.admin_change_password,
+            {
+                "id": user.id,
+                "password1": "newpassword",
+                "password2": "newpassword",
+            },
+        )
+
+    def test_cannot_change_own_password_as_unprivileged_using_admin(self):
+        unprivileged_user = factory.make_User()
+        handler = UserHandler(unprivileged_user, {}, None)
+
+        self.assertRaises(
+            HandlerPermissionError,
+            handler.admin_change_password,
+            {
+                "id": unprivileged_user.id,
+                "password1": "newpassword",
+                "password2": "newpassword",
+            },
+        )
+
+    def test_cannot_change_other_users_password_as_admin_bad_password(self):
+        admin_user = factory.make_admin()
+        handler = UserHandler(admin_user, {}, None)
+        user = factory.make_User()
+
+        self.assertRaises(
+            HandlerValidationError,
+            handler.admin_change_password,
+            {
+                "id": user.id,
+                "password1": "foo",
+                "password2": "bar",
+            },
+        )
diff --git a/src/maasserver/websockets/handlers/user.py b/src/maasserver/websockets/handlers/user.py
index 7a12ac0..865f331 100644
--- a/src/maasserver/websockets/handlers/user.py
+++ b/src/maasserver/websockets/handlers/user.py
@@ -5,7 +5,10 @@
 
 __all__ = ["UserHandler"]
 
-from django.contrib.auth.forms import PasswordChangeForm
+from django.contrib.auth.forms import (
+    AdminPasswordChangeForm,
+    PasswordChangeForm,
+)
 from django.contrib.auth.models import User
 from django.db.models import Count
 from django.http import HttpRequest
@@ -51,6 +54,7 @@ class UserHandler(Handler):
             "auth_user",
             "mark_intro_complete",
             "change_password",
+            "admin_change_password",
         ]
         fields = [
             "id",
@@ -208,3 +212,14 @@ class UserHandler(Handler):
             return self.full_dehydrate(self.user)
         else:
             raise HandlerValidationError(form.errors)
+
+    def admin_change_password(self, params):
+        """As Admin, update another user's password."""
+        if not self.user.is_superuser:
+            raise HandlerPermissionError()
+        user = self.get_object(params)
+        form = AdminPasswordChangeForm(user=user, data=get_QueryDict(params))
+        if form.is_valid():
+            form.save()
+        else:
+            raise HandlerValidationError(form.errors)